AGENTQ: Quantization-Conditioned Backdoor Attacks on LLM Agents
cs.CR · cs.AI
Quick verdict
针对 LLM 智能体的首次 QCA 研究：分层带 LoRA + 多码本 PGD 修复在接近基准效用的情况下实现了 0.76-1.00 的量化后 ASR；结果可信，但基于单一种子。
Summary
本文首次研究了针对 LLM 智能体的量化条件攻击（QCA）：攻击者发布一个通过良性审计的全精度检查点，但受害者量化部署后，模型表现恶意。将先前的 QCA（Egashira 等，2024）直接适应于智能体是失败的：全秩 SFT 加上全层 PGD 在量化后产生了高攻击成功率，但破坏了工具调用格式（预期一次调用却产生约 5 次调用，70% 的过度调用率）。AGENTQ 通过两个结构化限制解决了这个问题：阶段 I 在前中层带（0 到 ⌊2L/3⌋）通过七个投影上的 16 秩 LoRA 适配器注入后门，阶段 II 应用了投影到 NF4、FP4 和 INT8 量化等价类交集上的部分 PGD 修复。在 Qwen3.5-{2B,4B,9B} 和 Hammer2.1-{1.5B,3B,7B} 上的三组触发-动作对（xLAM 工具选择、xLAM 参数注入、AgentDojo 广告注入）中，所有检查点显示 ASR_FP16=0，量化 ASR 为 0.76–1.00（18 个单元中有 12 个 >0.90），且干净任务效用比大多接近 1.0。FastAPI 案例研究显示，字节完全相同的权重在 FP16 下表现良性，而在 NF4 下表现恶意。权重统计（附录 F）无法检测到该攻击。局限性：主要代码书仅限于 bitsandbytes（GPTQ 在结构上具有抗性），规模 ≤9B，未提出防御措施，单种子运行且未报告方差，部署探测（N=10）显示在完整注册表下，NF4 即使没有触发器也会触发接收器。
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 2
● low 3
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- AGENTQ is the first quantization-conditioned backdoor attack demonstrated against LLM agents, with a judge-free deterministic ASR metric.
Strengths
Novel, well-argued threat intersection
§1 articulates three concrete asymmetries of the agentic regime (executable payload without human checkpoint, deployment alignment with quantization, judge-free deterministic ASR via detector φ in Eq. 2), making the 'first agentic QCA' claim substantive rather than cosmetic.
Rigorous failure-mode diagnosis before the fix
§5.2.1 quantifies why direct-port QCA fails (quantized ASR 0.93–1.00 but ~5 tool calls per turn, 70% over-call, exact-call fidelity 0.31 vs 0.73); Appendix B/Table 5 shows repair-time distillation cannot fix it because the QEC constraint fixes quantized behavior — the failure is located at injection, not repair.
Ablation discipline
Deployment study surfaces a real benchmark blind spot
Thorough appendix coverage
Weaknesses
Single seed, no variance reporting
Stealth claims conflict with the deployment study
Metric definitions inconsistent between ablation and headline tables
'Minimal utility loss' oversells degraded cells
No defense and heuristic theory
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
AGENTQ: Preliminary Review
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is a quantization-conditioned attack (QCA) on LLMs?
An attack where an adversary publishes a full-precision model checkpoint that looks benign under audit, but becomes malicious once a victim loads it with quantization (e.g., 4-bit NF4) to save memory. It exploits the fact that many full-precision weight values round to the same low-precision codeword, letting the attacker steer the quantized model's behavior while the FP16 artifact stays clean and passes any full-precision safety evaluation.
What makes AGENTQ different from earlier quantization backdoors?
It targets LLM agents, whose payload is an executable tool call rather than text a human reads. The paper shows naive adaptation of prior attacks destroys tool-call formatting (about five calls where one is expected). AGENTQ confines the backdoor to a shallow front-middle layer band via a rank-16 LoRA injection, then repairs with partial PGD projected onto the intersection of NF4/FP4/INT8 quantization-equivalence classes, preserving tool-calling utility while keeping the FP16 checkpoint clean.
Can backdoored quantized models be detected?
According to the paper, weight-space statistics (near-boundary fraction, singular-value share, kurtosis) match clean models to 3–4 significant figures, and schema-constrained decoding or retry logic blocks only some payload types (argument injection still succeeds at 1.00). The proposed detection surface is behavioral: run the same checkpoint at full precision and under each quantization configuration and flag divergences, ideally paired with automated trigger search. No defense is implemented or evaluated.
Which quantization methods are vulnerable to this attack?
Per-weight, data-free schemes: bitsandbytes NF4, FP4, and INT8 in the main results (post-quantization ASR 0.76–1.00), and AWQ in an extension (ASR 0.87), because both round each weight independently on a fixed grid. GPTQ resists (ASR 0.00) because its Hessian error feedback makes each weight's code depend on its neighbors, breaking the equivalence-class repair. GGUF/llama.cpp formats and larger 30B–70B models were not evaluated.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures are unavailable as graphics; Figure 3 values cited here come from the embedded text and Appendix B/Table 5, not the rendered plots.
- Table 1's metric semantics (e.g., 'lower U_NF4 is better') are ambiguous in the extracted text; the Table 1 vs Table 2 discrepancy is flagged as a question rather than asserted as an error.
- The literal trigger phrase ('Reference token: sync audit packet') is taken from Appendix A; the parametrized ARG-INJ marker's exact wording is not given in the text.
- arXiv metadata (2609.14060, Sep 2026) and 2026-dated model releases/citations are taken at face value; no external verification was performed.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.